Notices by Dave "Wear A Goddamn Mask" Cochran :donor: (dave_cochran@infosec.exchange)

@MadSc13ntist @pluralistic

Maxim 29: The enemy of my enemy is my enemy's enemy. No more. No less.

@silverwizard you're right and should say so

@nuintari @silverwizard "i'd love to have been able to do this for ya but it looks like i literally cannot, gotta run byeeeeeeeeeeeeeeeeeeeee"

@brewsterkahle @internetarchive "Is a user's IP address PII?" I don't think we can answer that with a blanket yes/no the way we used to be able to. Cell phone IP? probably PII. laptop/tablet? mixed odds. desktop? way more likely, but still not a guarantee. non-traditional-computer "device" (fridge, roomba, thermostat, etc)? ....probably not.

@dalias @brewsterkahle @internetarchive PII is by definition and necessity able to be used to identify a single person. If more than one person has access to/uses a laptop/desktop computer, it ceases to be (guaranteeably) PII. Reasonable arguments can be made ("Okay so it was either the six year old or the 30 year old who was looking up [list of bad things here], which do we think is more likely?"), but if it can't immediately identify A person, it's not PII anymore.

#Mazeldon

@whereisthespai assume that no alternate channels exist or, at least, are practical to use

@silverwizard same question, but your company was recently acquired by a larger one, and the email address in question is an "@olddomain.com" one LONG after everyone's been given and told to start using the "@newdomain.com" addresses.

Hypothetical: a user emails the "help, i am experiencing/have just had a cybersecurity incident" email address in order to validate that it's the correct one. As a person on the team that handles those emails, how annoyed are you?

@silverwizard @thepracticaldev I mean...

@thepracticaldev why would i want to remake a mistake

@ZachWeinersmith counterpoint: the best Queen song is whichever one is currently playing

@silverwizard 20/80

@catsalad @jerry @SwiftOnSecurity